Security Hardener EUVD-2026-64605

The Security Hardener plugin must be installed and in an active state; the block_user_enum option must be enabled, which is its default state requiring no post-install configuration change. The attacker must hold a valid WordPress user account at Subscriber level or above; unauthenticated exploitation by anonymous visitors is not possible, as is_user_logged_in() still gates access. Exploitation is most accessible on sites with open user registration (Settings → General → 'Anyone can register' enabled), which allows the attacker to self-provision a Subscriber account. Sites where user registration is disabled are exposed only to existing authenticated users - employees, editors, contributors, or any account obtained via credential compromise. No specific plugin configuration beyond installation is required, and the vulnerability manifests on the first REST API request after plugin activation.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the real-world threat profile. Attack complexity is genuinely low - the vulnerability requires no race condition, no special timing, no chained gadget, and no elevated configuration. The only prerequisite is a valid WordPress account at any level, including the lowest-privilege Subscriber role. The default-on nature of the affected feature means every installation is vulnerable from the moment the plugin is activated, without any misconfiguration on the site owner's part. No EPSS score or KEV listing was provided in the available intelligence, so widespread or confirmed active exploitation cannot be asserted; however, the trivially simple exploitation path (a single authenticated HTTP request) combined with its critical impact - full administrative takeover of the WordPress installation - means this should be treated as a genuine priority for any site with user registration enabled or with any non-admin user accounts. Sites that have no user registration pathway and no existing low-privilege accounts have a meaningfully reduced exposure window but are not immune to insider or credential-compromise scenarios.

An attacker registers a Subscriber-level account on a WordPress site running Security Hardener 2.4.4 and issues a single authenticated POST request to /wp/v2/users with a JSON body specifying username, email, password, and roles set to administrator; the plugin's overwritten permission_callback returns true for any logged-in user, so WordPress Core creates the account with full administrative privileges. The attacker then authenticates as the new administrator, gaining complete control over site content, installed plugins, theme files, and the underlying database. In a second variant, the attacker targets an existing administrator's account by issuing a PUT request to /wp/v2/users/<id> to reset their password, locking out the legitimate owner and taking exclusive control.